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Listing of Claims : 

1 . (Currently Amended) An electronic voting methods comprising the step steps of: 

obtaining from a signer apparatus, using a fair blind signature scheme^ to 
obtain a digital signature (yi) of a data signal (*,-) from a voter apparatus, said data 
signal comprising a vot e r's vote (v,-) of a voter; and 

establishing, at a trusted authority apparatus, a link between a given 
digitally-signed data signal and a signing session in which said digital signature 
was generated, said trusted authority apparatus being enabled to establish the link 
via a tracing protocol included in the fair blind scheme . 

2. (Currently Amended) The voting method of claim 1, wherein the fair blind signature 
scheme is comprises a threshold fair blind signature scheme in which the digital signature is 
obtained from a sub-set of a group of servers which form said signer apparatus , the group of 
servers containing n servers and the sub-set containing t servers, where t < n. 

3. (Currently Amended) The voting method of claim 1, wherein the data signal (*,) 
corresponds to the vot e r's vote (v,) of the voter which is encrypted according to a first encryption 
scheme (Etm), said first encryption scheme being the encryption scheme of a first mix-net (TM) 
contained in a voter-tallying module , and the method further comprises the step of using said 
first mix-net (TM) to apply applying th e a decryption scheme (Dtm) which is an inverse [[to]] of 
said first encryption scheme to said data signal (x,) at said voter-tallying module wh e r e by to 
retrieve the vot e r's vote (v,) of the voter . 
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4. (Currently Amended) The voting method of claim [[3]] 20, and comprising the steps 

of: 

receiving, by a ballot-order-randomizing module, a batch of encrypted 
data signals (cj) from said ballot-box module, said encrypted data signals being in 
a first order within said batch [r,]1 a batch of encrypted data signals (c/), each 
encrypted data signal (c,-) comprising data encrypted according to a second 
encryption scheme (E M ) and said data including a respective data signal (xi \ the 
encrypted data signal (q) including the vote (vi) of the voter subjected to plural 
levels of encryption ; 

retrievin g, in said ballot-order-randomizing module, each respective data 
signal (xi) from the respective encrypted data signal (c,) in said batch of encrypted 
data signals (cj) by applying a decryption scheme (Dm) which is an inverse [[to]] 
of said second encryption scheme (Em)\ and 

outputting the retrieved data signals (x) for said batch of encrypted data 
signals (cj) in a different order from said first order ; and 

receiving, by said vote-tallying module, said retrieved data signals fa) in 
said different order . 

5. (Currently Amended) The voting method of claim 4, wherein said second encryption 
scheme is the encryption scheme of a second mix-net (M) in said ballot-order-randomizing 
module, said second mix-net comprising a plurality of mix-servers . 
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6. (Currently Amended) The e l e ctronic voting method of claim 5, and further comprising 
the step steps of 

detecting irregularities in th e voting process, said st e p of det e cting 
irr e gulariti e s comprising v e rifying that th e one or more ballots to be counted do 
not contain duplicated data-pairs, wherein a data-pair corresponds to one of said 
data signals and the digital signature thereof for each of said one or more ballots, 
said mix-servers of said second mix-net (M) being prompted to generate 
zero-knowledge proofs of knowledge; and 

if a particular mix-server (MJ) of said second mix-net (M) does not 
generate a satisfactory zero knowledge proof of the knowledge as a result of said 
prompting step, applying said decryption scheme (Dm) which is the inverse of 
said second encryption scheme (Em) using said second mix-net (M) which 
excludes said particular mix-server (Mj) to retrieve said data signals (xi) . 

7. (Currently Amended) The e l e ctronic voting method of claim [[5]] 20, and further 
comprising the step steps of: 

comparing vote data held by the signer apparatus with vote data held by 
the ballot-box module to detect det e cting irregularities in one or more of the 
voting proc e ss, wh e r e in th e st e p of d e t e cting irr e gulariti e s comprises ch e cking the 
validity of th e digital signatur e s in the ballots to be counted. 

8. (Currently Amended) The e l e ctronic voting method of claim [[5]] 6, and further 
comprising the step steps of: 
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detecting irr e gulariti e s in th e voting proc e ss, wh e rein th e st e p of d e t e cting 
irr e gulariti e s compris e s ch e cking that there is no ov e rlap b e tw ee n th e ballots to b e 
count e d and e ntries in a r e vocation list 

controlling said trusted authority apparatus such that said tracing protocol 
of said fair blind signature scheme is applied to identify the signed data signals 
corresponding to said one or more ballots to be counted; and 

including said identified signed data signals in a revocation list recording 
ballots that have been rejected . 

9. (Currently Amended) An el e ctronic The voting method according to of claim 1 , and 
further comprising the steps of: 

receiving said data signal (x,) for the digital signature according to said 
fair blind signature scheme at a server module {AS) of said signer apparatus , said 
data signal (jc,-) comprising [[a]] the vote (v,) selected by [[a]] the voter (Vi) 9 said 
vote (vi) being encrypted according to said a first encryption scheme (Etm), 
blinded according to said fair blind signature scheme and digitally signed 
according to a digital signature scheme of said voter; 

verifying, by said server module {AS), that the digital signature (s,) in the 
received data signal is valid; 

in th e cas e cases where the verifying step confirms that the digital 
signature in the data signal received by said server module {AS) is valid, said 
server module {AS) digitally signs the blinded encrypted vote (e,) according to 
said fair blind digital scheme and outputs a the digitally-signed message (S^e,-)); 
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unblinding the digitally-signed message (S^e,)) to yield said digital 
signature (yi) of the data signal (*,); 

encrypting said data signal (jc,-) and said digital signature (yi) of the data 
signal thereof according to smd a second encryption scheme (E M ) to produce an 
encrypted data signal (c,); and 

signing said encrypted data signal {cj} according to [[a]] the digital 
signature scheme of the voter {VI). 



10. (Currently Amended) An electronic voting system comprising: 

a plurality of voter modules each including a first processor; (+0)[[,]] and 
an admin server module including a second processor; (30)^ 
wherein [[a]] the first processor, a voter module (4-0) and the second 
processor in the admin server module (30) cooperate m during a respective 
signing session in application of a fair blind signature scheme wh e r e by to obtain^ 
from said admin server module, a digital signature (yi) of a data signal (jc,) from a 
voter module, said data signal (xj) comprising the a respective vot e r's vote (v,) of 
a voter, said fair blind signature scheme having a tracing protocol which enables a 
trusted authority apparatus to establish a link between a given digitally-signed 
data signal and a signing session in which said digital signature was generated . 

11. (Currently Amended) A voter module (10) adapted including a first processor 
configured to cooperate with a second processor in an admin server module (30) during a 
respective signing session in application of a fair blind signature scheme wh e r e by to obtain , from 
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said admin server module, a digital signature (yi) of a data signal (*,•) from the voter module, said 
data signal (xi) comprising th e vot e r's a vote (v/) of a voter, said fair blind signature scheme 
having a tracing protocol which enables a trusted authority apparatus to establish a link between 
a given digitally-signed data signal and a signing session in which said digital signature was 
generated . 

12. (Currently Amended) A computer computer-readable medium encoded with a 
computer program executed by a computer that causes a first processor to cooperate with a 
second processor in an admin server module during a respective signing session in application of 
a fair blind signature scheme, the computer program comprising: 

having a s e t of instructions which, wh e n in us e on comput e r apparatus, adapt said computer 
apparatus so as to constitut e a vot e r modul e (10) according to claim 1 1 

program code for obtaining, from said admin server module, a digital 

signature (yj) of a data signal (jc/), said data signal (xi) comprising a vote (W) of a 

voter; and 

program code for establishing, at a trusted authority apparatus, a link 
between a given digitally-signed data signal and a signing session in which said 
digital signature was generated, said trusted authority apparatus being enabled to 
establish the link via a tracing protocol included in the fair blind scheme . 

13. (Currently Amended) A voting system admin server module including a first 
processor (20) adapt e d configured to cooperate with a second processor in a voter module during 
a respective signing session (4-0) in application of a fair blind signature scheme wh e r e by to 
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obtain , from said admin server module, a digital signature (y,) of a data signal (xi) from said voter 
module, said data signal (xi) comprising th e vot e r's a vote (v,-) of a voter, said fair blind signature 
scheme having a tracing protocol which enables a trusted authority apparatus to link a given 
digitally-signed data signal with a signing session in which said digital signature was generated 
by said admin server module . 

14. (Currently Amended) A computer-readable medium encoded with a computer 
program that causes a first processor to cooperate with a second processor in a voter module 
during a respective signing session in application of a fair blind signature scheme, the computer 
program comprising: 

having a set of instructions which, wh e n in us e on comput e r apparatus, adapt said comput e r 
apparatus so as to constitute a voting syst e m admin serv e r modul e (20) according to claim 1 3 
program code for obtaining a digital signature (yi) of a data signal (jc,-) from 

said voter module, said data signal (xi) comprising th e vot e r's a vote (v f -) of a 

voter; and 

program code for establishing, at a trusted authority apparatus, a link 
between a given digitally-signed data signal and a signing session in which said 
digital signature was generated, said trusted authority apparatus being enabled to 
establish the link via a tracing protocol included in the fair blind scheme , 

15. (Currently Amended) A voting system ballot-order-randomizer randomiz e r module 
(40) comprising a processor configured to provide : 
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input means for receiving a batch of cast votes, each cast vote comprising 
an encrypted data signal (c,) comprising data (x L ) indicative of a respective vot e r's 
vote (v,-) of a voter which is digitally signed according to a fair blind signature 
scheme, said fair blind signature scheme having a tracing protocol which enables 
a trusted authority apparatus to establish a link between a given digitally-signed 
data signal and a signing session in which said digital signature was generated, 
each encrypted data signal (c,-) being encrypted according to a predetermined 
encryption scheme (Em); afid 

a mix-net (A/) for decrypting said encrypted data signals (c,-) by applying a 
decryption scheme (D M ) which is an inverse [[to]] of said predetermined 
encryption scheme {E M )\ and 

output means for outputting the decrypted signals of said batch of cast 
votes in an order different from the order of the corresponding encrypted data 
signals in said batch of cast votes . 

16. (Currently Amended) A computer-readable medium encoded with a computer 
program that causes a voting system ballot-order-randomizer to randomize a batch of cast votes, 
the computer program comprising: 

having a s e t of instructions which, wh e n in us e on comput e r apparatus, adapt said comput e r 
apparatus so as to constitut e a voting syst e m randomiz e r modul e (40) according to claim 15 
program code for receiving, at an input means, a batch of cast votes, each 
cast vote comprising an encrypted data signal (c/) comprising data (xj) indicative 
of a respective vote (v[) of a voter which is digitally signed according to a fair 
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blind signature scheme, said fair blind signature scheme having a tracing protocol 
which enables a trusted authority apparatus to establish a link between a given 
digitally-signed data signal and a signing session in which said digital signature 
was generated, each encrypted data signal (cj) being encrypted according to a 
predetermined encryption scheme (Em)\ 

program code for decrypting, at a mix-net (M) % said encrypted data signals 
(ci) by applying a decryption scheme (Dm) which is an inverse of said 
predetermined encryption scheme (Em)\ and 

program code for outputting, at an output means, the decrypted signals of 
said batch of cast votes in an order different from the order of corresponding 
encrypted data signals in said batch of cast votes , 

17. (Currently Amended) A voting system tallier tallying module (#0) comprising a 
processor configured to provide : 

input means for receiving cast votes, each cast vote comprising a data 
signal (jc,) digitally signed according to a fair blind signature scheme, said fair 
blind signature scheme having a tracing protocol which enables a trusted authority 
apparatus to establish a link between a given digitally-signed data signal and a 
signing session in which said digital signature was generated, each data signal (pel) 
comprising a respective vot e r's vote (v,) of a voter which is encrypted according 
to an encryption scheme (Etm)\ and 
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a mix-net (M) for decrypting said encrypted votes (v,) by applying a 
decryption scheme (D T m) which is an inverse [[to]] of said encryption scheme 
(Em)- 

18. (Currently Amended) A computer-readable medium encoded with a computer 
program that causes tallying of cast votes, the computer program comprisinR: 

having a s e t of instructions which, wh e n in us e on comput e r apparatus, adapt said comput e r 
apparatus so as to constitut e a voting syst e m talli e r modul e (50) according to claim 17 

program code for receiving, at an input means, cast votes, each cast vote 
comprising a data signal fc) digitally signed according to a fair blind signature 
scheme, said fair blind signature scheme having a tracing protocol which enables 
a trusted authority apparatus to establish a link between a given digitally-signed 
data signal and a signing session in which said digital signature was generated, 
each data signal (xj) comprising a respective vote (vj) of a voter which is 
encrypted according to an encryption scheme (E t m)\ and 

program code for decrypting, at a mix-net (M), said encrypted votes (vj) by 
applying a decryption scheme (Dtm) which is an inverse of said encryption 
scheme (Etm) . 

19. (New) The voting method of claim 1, wherein the data signal (*,-) corresponds to the 
vote (v,-) of the voter which is encrypted according to a first encryption scheme (Etm), said first 
encryption scheme comprising an encryption scheme of a vote-tallying module, and the method 
further comprising the step of applying a decryption scheme (Dtm) which is an inverse of said 
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first encryption scheme to said data signal (*,) at said vote-tallying module to retrieve the vote 
(v,) of the voter. 

20. (New) The voting method of claim 19, further comprising the steps of: 

setting a time period during which voting is authorized; 

communicating a plurality of encrypted data signals (q) to a ballot-box 
module, each of said plural encrypted data signals (c,-) including data from a 
respective voter indicative of the vote (v,) of said voter and digitally-signed by 
said signer apparatus; and 

outputting, by said ballot-box module, said encrypted data signals (c,-) to 
said vote-tallying module after expiration of the time period in which voting is 
authorized. 

21 . (New) The voting method of claim 7, further comprising the steps of: 

controlling said trusted authority apparatus such that said tracing 
protocol of said fair blind signature scheme is applied to identify signed data 
signals corresponding to said one or more of the ballots to be counted; and 

including said identified signed data signals in a revocation list 
recording ballots that have been rejected. 
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